Add Ledger root CA for origin devices

### Is your feature request related to a problem?

Today, we are not allowing Ledger devices to join as they are not yet authorized
But Ledger devices are great example and experimentation of the decentralized Keychain

### Describe the solution you'd like

We should authorize the Ledger CA as list of origin certificates

- [ ] Update the conf
- [ ] Update crypto.ex to support it for the enlisting of new keys

### Additional context

Epic: #149

Start with the configuration that defines origin certificates and read crypto.ex around the enlisting of new keys, comparing how existing origin CAs are handled. Done means the Ledger root CA is authorized for origin devices and the enrollment path accepts Ledger keys without weakening authorization.

Written by the indexing model from the issue text.